HashiCorp Vault Associate (003) Question 43
Single answer2a Explain the value of Vault policiesA platform team is onboarding a payment application to HashiCorp Vault. The application only needs to read its own database credentials from the path database/creds/payments-role. Security wants to ensure the app cannot read secrets from other paths, create tokens, or manage Vault system settings. Which action best demonstrates the value of Vault policies in this scenario?
- A
Attach a policy to the application's token that grants only
readcapability ondatabase/creds/payments-role. - B
Place the application in Vault's root policy so it can inherit all permissions and rely on audit logs to detect misuse.
- C
Enable a new auth method for the application, because auth methods define what paths a client can access after login.
- D
Create a secrets engine role named
payments-role, because the role itself enforces all access boundaries across Vault.
Show answer and explanation
Correct answer: A
Explanation
Vault policies provide authorization by defining which capabilities a client has on which paths, making them central to least-privilege access control. In this scenario, the application's requirement is narrow: read generated credentials from one path and nothing else. A policy attached to the app's token is the correct way to enforce that requirement. This demonstrates the value of policies: they reduce blast radius, separate authentication from authorization, and let teams safely give applications only the minimum access they need. According to HashiCorp Vault documentation and best practices, policies are path-based and capability-based, while auth methods authenticate identities and issue tokens, and audit devices record activity but do not enforce permissions.
- A. Correct.
Correct. Vault policies are the primary authorization mechanism that define what authenticated clients can do on specific paths. By attaching a policy that allows only
readondatabase/creds/payments-role, the team applies least privilege and limits the application's access to exactly what it needs. This is the core value of Vault policies: fine-grained, path-based access control. - B. Incorrect.
Incorrect. The root policy grants broad administrative access and is not appropriate for applications. Audit logs help with visibility and investigation, but they do not prevent unauthorized actions. The misconception here is treating monitoring as a substitute for authorization. Vault policies should restrict access before an action occurs.
- C. Incorrect.
Incorrect. Auth methods verify identity and issue tokens, but they do not by themselves define detailed permissions. After authentication, Vault evaluates the token's attached policies to determine allowed actions. A candidate might choose this because auth and authorization are closely related, but in Vault they are separate concerns.
- D. Incorrect.
Incorrect. A role in a secrets engine, such as a database role, defines how credentials are generated or mapped within that engine. It does not replace Vault's policy system for authorizing access across paths. The misconception is assuming backend-specific roles are the same as Vault-wide access control.